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Introduction 


The Information Commissioner (the Commissioner) is calling for evidence 
and views on the Age Appropriate Design Code (the Code). 


The Code is a requirement of the Data Protection Act 2018 (the Act). The 
Act supports and supplements the implementation of the EU General Data 
Protection Regulation (the GDPR). 


The Code will provide guidance on the design standards that the 
Commissioner will expect providers of online ‘Information Society 
Services’ (ISS), which process personal data and are likely to be accessed 
by children, to meet. Once it has been published, the Commissioner will 
be required to take account of any provisions of the Code she considers to 
be relevant when exercising her regulatory functions. The courts and 
tribunals will also be required to take account of any provisions they 
consider to be relevant in proceedings brought before them. The Code 
may be submitted as evidence in court proceedings. 


Further guidance on how the GDPR applies to children’s personal data can 
be found in our guidance Children and the GDPR. It will be useful to read 
this before responding to the call for evidence, to understand what is 
already required by the GDPR and what the ICO currently recommends as 
best practice. In drafting the Code the ICO may consider suggestions that 
reinforce the specific requirements of the GDPR, or its overarching 
requirement that children merit special protection, but will disregard any 
suggestions that fall below this standard. 


The Commissioner will be responsible for drafting the Code. The Act 
provides that the Commissioner must consult with relevant stakeholders 
when preparing the Code, and submit it to the Secretary of State for 
Parliamentary approval within 18 months of 25 May 2018. She will publish 
the Code once it has been approved by Parliament. 


This call for evidence is the first stage of the consultation process. The 
Commissioner seeks evidence and views on the development stages of 
childhood and age-appropriate design standards for ISS. The 
Commissioner is particularly interested in evidence based submissions 
provided by: bodies representing the views of children or parents; child 
development experts; providers of online services likely to be accessed by 
children, and trade associations representing such providers. She 
appreciates that different stakeholders will have different and particular 
areas of expertise. The Commissioner welcomes responses that are 
limited to specific areas of interest or expertise and only address 
questions within these areas, as well as those that address every question 
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asked. She is not seeking submissions from individual children or parents 
in this call for evidence as she intends to engage with these stakeholder 
groups via other dedicated and specifically tailored means. 


The Commissioner will use the evidence gathered to inform further work 
in developing the content of the Code. 


The scope of the Code 


The Act affords the Commissioner discretion to set such standards of age 
appropriate design as she considers to be desirable, having 

regard to the best interests of children, and to provide such guidance as 
she considers appropriate. 


In exercising this discretion the Act requires the Commissioner to have 
regard to the fact that children have different needs at different ages, and 
to the United Kingdom’s obligations under the United Nations Convention 
on the Rights of the Child. 


During Parliamentary debate the Government committed to supporting 
the Commissioner in her development of the Code by providing her with a 
list of ‘minimum standards to be taken into account when designing it.’ 
The Commissioner will have regard to this list both in this call for 
evidence, and when exercising her discretion to develop such standards 
as she considers to be desirable 


In developing the Code the Commissioner will also take into account that 
the scope and purpose of the Act, and her role in this respect, is limited to 
making provision for the processing of personal data. 


Responses to this call for evidence must be submitted by 19 September 
2018. You can submit your response in one of the following ways: 


Online 


Download this document and email to: 


childrenandtheGDPR@ICO.org.uk 


Print off this document and post to: 

Age Appropriate Design Code call for evidence 
Engagement Department 

Information Commissioner’s Office 

Wycliffe House 

Water Lane 

Wilmslow 
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Cheshire SK9 5AF 


If you would like further information on the call for evidence please 
telephone 0303 123 1113 and ask to speak to the Engagement 
Department about the Age Appropriate Design Code or email 


childrenandtheGDPR@ICO.org.uk 


Privacy statement 

For this call for evidence we will publish responses received from 
organisations but will remove any personal data before publication. We 
will not publish responses from individuals. For more information about 
what we do with personal data please see our privacy notice. 
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Section 1: Your views and evidence 


Please provide us with your views and evidence in the following areas: 


Development needs of children at different ages 


The Act requires the Commissioner to take account of the development 
needs of children at different ages when drafting the Code. 


The Commissioner proposes to use their age ranges set out in the report 
Digital Childhood - addressing childhood development milestones in the 
Digital Environment as a starting point in this respect. This report draws 
upon a number of sources including findings of the United Kingdom 
Council for Child Internet Safety (UKCCIS) Evidence Group in its literature 
review of Children’s online activities risks and safety. 


The proposed age ranges are as follows: 


3-5 
6-9 
10-12 
13-15 
16-17 


Q1. In terms of setting design standards for the processing of children’s 
personal data by providers of ISS (online services), how appropriate you 
consider the above age brackets would be (delete as appropriate): 


Quite appropriate 


Q1A. Please provide any views or evidence on how appropriate you 
consider the above age brackets would be in setting design standards for 
the processing of children’s personal data by providers of ISS (online 
services), 


The developmental milestones for children fall fairly well into these 
brackets, although it may be more sensible to keep them within year 
groups or at least key stages - e.g. a 10 year old might be in Year 6 and 
a 12 year old in Year 8 depending on when you did the survey and their 
birthdays, making them also in different schools. Perhaps 3-6, 7-9, 10-11, 
12-13, 14-15, 16-17 might be better. 
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Q2. Please provide any views or evidence you have on children’s 
development needs, in an online context in each or any of the above age 
brackets. 


Working in a through school and having 
ompleted an MSc in Child and Adolescent Mental Health with a 
dissertation I feel 
strongly that the case for the benefits of technology for teens and children 
has been vastly overstated and the propaganda for educational benefits 
worked a treat! The result is furious back peddling from schools and 
parents realising that they have opened Pandora’s box! I banned phones 
in our school 2 years ago now and we have 
never looked back. Parental support is almost 100%, and children - if you 
ask them privately are relieved of the official opportunity to be 
disconnected. Anxiety, stress, unkindness/bullying, sexting, the 
magnifying of all normal interactions have been reduced since the change 
in policy and my advice to parents has been stronger and repeated more 
often! 


The United Nations Convention on the Rights of the Child 


The Data Protection Act 2018 requires the Commissioner to take account 
of the UK’s obligations under the UN Convention on the Rights of the Child 
when drafting the Code. 


Q3. Please provide any views or evidence you have on how the 
Convention might apply in the context of setting design standards for the 
processing of children’s personal data by providers of ISS (online 
services) 


Having some time limits recommended nationally and by 
Government would be a huge help. Neither parents nor children really 
have a clue and as a result parents have little power to say ‘that is 
enough’ to their teen because their teen will say ‘says who?’. I use Dan 
Siegel’s health mind platter with parents and children and this ensures 
that we are enabling children the right to have a childhood by not being 
consumed by a vehicle that was designed originally for adults, but has the 
more powerful impact on children. Neuroscience has been a real step 
forward in helping explain to parents and teens why they need to 
moderate their use and we are making it part of our PSHE curriculum 
(incidentally I think it should also form part of teacher training). 


Aspects of design 


The Government has provided the Commissioner with a list of areas which 
it proposes she should take into account when drafting the Code. 
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These are as follows: 

« default privacy settings - essential 

e data minimisation standards, 

e the presentation and language of terms and conditions and privacy 

notices, - they still won’t read them! 

e uses of geolocation technology, - should be standard 

e automated and semi-automated profiling, 

e transparency of paid-for activity such as product placement and 
marketing, - parents should be informed because teens are 
not always capable of making sensible decisions, regardless 
of transparency if social capital cost is high enough 
the sharing and resale of data, - yes certainly 
the strategies used to encourage extended user engagement, 
user reporting and resolution processes and systems, 

XX the ability to understand and activate a child’s right to 

erasure, rectification and restriction, - critical 

e the ability to access advice from independent, specialist advocates 
on all data rights, and 

e any other aspect of design that the commissioner considers 
relevant. 


Q4. Please provide any views or evidence you think the Commissioner 
should take into account when explaining the meaning and coverage of 
these terms in the code. 


Have made some points in bold. 


I worry that this list is esoteric complicated jargon in parts. Whilst some 
are important, the simplest thing is missing - how long is too long for 
children of different ages? Parents and children, like most of us, never 
read the small print, are unlikely to follow through on their complicated 
‘rights’ and we would be better off simplifying the advice and guidance in 
several areas well/clearly. There is not enough focus on the accumulative 
developmental damage endless digital media can cause. 


Q5. Please provide any views or evidence you have on the following: 
Q5A. about the opportunities and challenges you think might arise in 


setting design standards for the processing of children’s personal data by 
providers of ISS (online services), in each or any of the above areas. 
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XX - on this point, I feel that a good and ongoing advertising campaign 
on the side of Instagram/Fbk etc is important and that drip drip effect is 
important. Ensuring this and other key messages are in the curriculum is 
key. Some lovely families just do not have the technical know how to 
explain these messages to their families and sticking it in the IT 
curriculum, where typically(or at least historically) many teachers are not 
equipped to teach this sensitively is also not ideal. I really feel teachers 
need to be taught how to teach it - not necessarily in one subject but 
perhaps a module in all subjects - and of course in PSHE. Until PSHE has 
any currency however with schools, it is always likely to end up a poor 
relative to other subjects they learn - despite the impact of not learning it 
properly being more detrimental! 


Q5B. about how the ICO, working with relevant stakeholders, might use 
the opportunities presented and positively address any challenges you 
have identified. 


Taking opportunities to work with teachers and schools, rather than just 
IT/Web providers/medical professionals to enable this education to filter 
through in the most effective way. This in my view, is also the best way 
to work with parents as they tend to trust their child’s school and read 
things you send them,as opposed to switch off when more ‘official’ or 
‘political’ views/legislation is sent to them. 


Q5C. about what design standards might be appropriate (ie where the bar 
should be set) in each or any of the above areas and for each or any of 
the proposed age brackets. 


There needs to be more age verification checks - most kids have 
accounts before they are the age they claim with little to stop them. I am 
not a technological expert though so sorry, can’t contribute much to this 
and Q5d. 


Q5D. examples of ISS design you consider to be good practice. 
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Q5E. about any additional areas, not included in the list above that you 
think should be the subject of a design standard. 


Q6. If you would be interested in contributing to future solutions focussed 
work in developing the content of the code please provide the following 
information. The Commissioner is particularly interested in hearing from 
bodies representing the views of children or parents, child development 
experts and trade associations representing providers of online services 
likely to be accessed by children, in this respect. 


Brief summary of what you think you could offer 


I have 
I have seen 
such a massive change in this area, with parents, children and staff and 


although at school, it is the teens who have benefited from changes to 
rules and the curricular 
nd have also seen the benefit for them as they enjoy a more 
‘Famous Five’ type childhood!! I could not feel more passionate about the 
cause to make young people the master of Digital Media and Technology 


rather then its servant. 
Further views and evidence 
Q7. Please provide any other views or evidence you have that you 


consider to be relevant to this call for evidence. 
I hope I have answered some of this in the previous questions 
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Section 2: About you 


Are you: 


A body representing the views or interests of children? 
Please specify: 
Yes - 


Independent School Age 4-18, and ISI Inspector 


A body representing the views or interests of parents? 
Please specify: 

Yes - I regularly write and post to parents, as 
well as have small committee meetings with interested 
groups in person and am involved with a Digital Think 
Tank in North London 


A child development expert? 
Please specify: 

Expert a bit strong! But certainly know a lot more 
since completion of my MSc 


A provider of ISS likely to be accessed by children? 
Please specify: 


Yes - in lessons although of course , the majority of 
online interaction for kids is on their own devices. 


A trade association representing ISS providers? 
Please specify: 
No 


An ICO employee? 
No 
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Other? 
Please specify: 


Thank you for responding to this call for evidence. 
We value your input. 
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